ISE Guest Activity Report

In accord with the user guide, ISE should be able to report what URLs a guest had visited. For this functionality to work "you must enable guest access syslogging configuration on the NAD that inspects guest traffic in your Cisco ISE network".
How can I do that if my guest users only have access through wireless? I mean what should I config in the WLC?
Thanks in advance

In Cisco ISE, system logs are collected at locations called logging targets. Targets refer to the IP addresses of the servers that collect and store logs.
ISE has the following default targets, which are dynamically configured in the loopback addresses of the local system:
•LogCollector—Default syslog target for the Log Collector.
•ProfilerRadiusProbe—Default syslog target for the Profiler Radius Probe.
You can generate and store logs locally, or you can use the FTP facility to transfer them to an external server.
Please check the following link,
http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_logging.html#wp1076091

Similar Messages

ISE Guest Activity Report not working (1.2.0.899)

Recently I upgraded an ISE to 1.2.0.899. I found the Guest Activity Report is not working. Before the upgrade it was working properly (with the limitation of 5000 records by report). Nothing in the ASA was modified, but nothing is reported in the ISE; also I use the tcpdump integrated in the ISE to validate the syslog messages are arriving from the ASA to the ISE. I already enable the Passed Authentication logging category.
Do I need to modify something else,to have the report?

Hi
Please make sure these steps has configured correctly:
Step 1 Create an alarm, as described in Creating, Editing, and Deleting Alarm Schedules.
Step 2 Specify a rule for Passed Authentication, Failed Authentications, or Authentication Inactivity for all users of type guest, as described in Creating and Assigning an Alarm Rule.
Step 3 Calculate guest user activity by Monitoring Live Authentications.

ISE Guest activity reports configuration

Hi All,
I am trying to obtain guest activity report pertaining to the websites accessed by the guests. I have a standalone ISE deployement (1.1.2) running all personas. I am following the instructions on this document in a way:
http://www.cisco.com/en/US/products/ps6128/products_configuration_example09186a0080ac2fda.shtml#asac
I have configured the sysloging on my ASA gateway this way:
logging on
logging list WebLogging message 304001
logging trap WebLogging
logging facility 21
logging host inside <ISE-ip-address> 17/20514
I also configured http inspection:
policy-map global_policy
class inspection_default
inspect http
service-policy global_policy global
Accounting is configured on the WLC and pointing to the ISE node.
I am using CWA for guest access. This is working as expected. The Sponsor creates the account then the guest logs in successfully using the account created. I only need to have the guest activity reported. So far no luck and the activity report is empty. Any pointers are greatly appreciated.
Fadi

Hi Fashour:
I will began test to generate this kind of reports soon (I need to wait por authorization to get access to ASA and change current config) I have some questions:
Did you configure something in the ISE to enable it as syslog server?
Can it be possible that you paste an image with the report results as a sample? I like to show my company and my customer what kind of reports we should expect ..
Regards.

Guest Activity on Cisco ISE

Is it possible to monitor the web pages visited for a guest using cisco ISE?

Hi Gino,
Yes, you can use the Guest Activity option. The Guest Activity report provides details about the websites that guest users are visiting. You can use this report for security auditing purposes to demonstrate when guest users accessed the network and what they did on it.
This report is available at: Operations > Reports > Endpoints and Users > Guest Activity.
To use this report you must first:
•Enable the passed authentications logging category. Choose Administration > Logging > Logging Categories and select Passed authentications.
•Enable these options on the firewall used for guest traffic:
–Inspect HTTP traffic and send data to Cisco ISE Monitoring node. Cisco ISE only requires the the IP address and accessed URL for the Guest Activity report so, if possible, limit the data to include just this information.
–Send syslogs to Cisco ISE Monitoring node
Please check the below link for further information,
http://www.cisco.com/en/US/docs/security/ise/1.2/user_guide/ise_guest_pol.html#wp1056645

ISE 1.3 Guest Activity

Hello,
is in the ise version 1.3 a possiblity that I can display the Guest Activity and export it via FTP?
What I'd like to see is: Which user opens which website/service. What kind of activity is the guest doing during he is using our guest wifi.
Regards
Filip

Hello Filip. No such an option is available in ISE. Moreover, only the Guest authentication traffic hits ISE. Once the guest user is authenticated the traffic no longer flows through ISE, thus, ISE has no visibility to what the user is actually doing on the network.
This sort of information would be best collected by your web security appliance. So for instance, if you have Cisco WSA/CWSA.
Thank you for rating helpful posts!

Guest users in Portal Activity Report

Hi All,
We have implemented Portal Activity Report in our portal. We are tracking only the pages and we have set the property Authentication Scheme to default for all the pages.
The reports are working fine except for the fact that the reports are showing up large number of anonymous users logging in as Guest for e.g. Guest 1, Guest 2, Guest 3 etc. Our landscape has no Anonymous users.
Can anyone tell me why the report is showing up large number of Guest users (Type - Anonymous Users) though we donu2019t have any anonymous Users?
How to get rid of these Anonymous Guest users in the Portal Activity Report?
Kindly help me to resolve this issue.
Regards,
Adren D'Souza

Hi Adren,
The AR shows what it gets.
The first posibility, is somewhere anonymous users do have access to content or some operations are being considered as anonymous.
I suggest to check all the properties which should disable the anonymous, whether there is any content which is exposed as anonymous:
1)Search the roles which are assigned to Guest user.
2)Make sure that the "Guest" user is disabled.
The second possibility u2013 there is an old data in DB tables.
What type of report are we discussing? Is this the "Details about the users who logged on" report?
If it is, check the WCR_* DB tables whether there any u2018au2019 type users.
If there is, I would recommend you to delete those entries ("WHERE USERTYPE = 'a'), it could be the old data, before you have applied the note.
Best Regards,
Victoria Gur
| Installed Base Development Engineer
| NetWeaver Portal Platform
| SAP Labs Israel

Portal Activity Report query

Hello All,
The Portal Activity Report shows data under Authenticated and Anonymous Columns
Questions:
1. Portal is not configured for anonymous authentication. So from where does it collect data and show data under anonymous column?
2. How can I disable the anonymous part? And done so, will this have any affect on the way the Authenticated figures are collected?
Please share your experience on this.
Awaiting Reply.
Thanks,
PRanjan

Even if you don't think you have any anonymous access, there is a default user Guest who is part of the Anonymous Users group who seems to access the portal!
Not sure how to hide it. Sorry...

ISE Guest Accounting Identity

Hello Guys,
i have an ISE 1.2 with Patch 9 installed.
Now i want to have a correlated View of Guest User Name <-> IP Address
When i go under Operations -> Reports -> Guest Accouting i just get the MAC Adress as Identity Value. Is there any configuration i can made to show the GuestUser as Identity ?
I added a picture of my corrent output
Thanks
Philip

Guest user Identity is getting updated with Mac addr. instead identity
CSCuh14138
Description
Symptom:
Guest user Identity is getting updated with Mac. address instead of identity in Guest accounting reports.
Conditions:
issue is seen in Guest accounting reports
Workaround:
no work around
Known Affected Releases:
(4)
1.2(0.852)
1.3(0.566)
1.3(0.620)
1.2(0.899)

Anonymous Users in Activity Reports

Hi All,
When i checked the activity reports in User administration, I see that there are some Anonymous users logged in.
Can somebody explain me who they are and how do we identify these anonymous users ?
Note: We don't have any anonymous logins enabled...Thanks in advance.

Hi,
I don't know exactly how the PAR are generated, but maybe the report is only looking into the authentication scheme necessary to access the iView. By default, some default-iViews from SAP (DTN, Portal Favorites, etc) is set to anonymous.
I guess that even if you have anonymous access disabled (Guest user disabled), the used authentication scheme (anonymous) will be responsible that you see "Anonymous" Users in the reports.
You can try to set the scheme to "default" or higher and verify if the anonymous users are eliminated from your reports (but his will take some time).
br,
Tobias

Activity Report download is saved without extension and unreadable

Hello,
The Portal Activity Report iView has a button which enables the user to download the report to his PC.
The problem is that when the user clicks on that button and saves the file it is being saved by this default name: com.sap.portal.activityreport.frontend.DownloadableActivityReport
The main problem is that it is being saved by default without any extension and after saving the user needs to manually add the .xls suffix.
Another problem is that once I open the report with Excel The Object Name column is unreadable.
Is there any way to resolve these issues?
Roy

Hi Roy,
> if it wasn't supported there
> or you would still consider it as a bug?
The feature in general of course was supported, but what I cannot say is if it was a known issue that it didn't work correctly. As I dont't use the ActivityReport, I also have no experience if it didn't work at some time and maybe now is working.
The wrong filename I don't expect to be corrected in the meanwhile, as said, that's a problem in some places. So at least for this you could open an OSS message. And maybe combine this with the problematic column issue.
But if upgrading to SP18 would be an option for you, maybe you could first test that.
Hope it helps
Detlev

No data in Portal Database tables for Activity Report

Hi experts,
I've developed an Activity Report application in SAP Portal 7.0, which went live but the report shows no data.
We are pulling data from 2 portal database tables: WCR_WEBCONTENTSTAT and WCR_USERPAGEUSAGE
In non production environment there is data in the report but there is no data in the production environment.
The Activity Report service is already activated/started and set to true.
What could have caused this? And what should we check now?
What other configurations/setup should be done?
Regards,
Greg

Hi Greg,
Those are the aggregated tables. If they are not filled with data although the Portal Activity Report is activated, you should check whether the aggregation finished successfully.
In the older SPs there were some problems that were fixed in later SPs of 7.0.
In order to have the latest version of Portal Activity report, you can check SAP note 1084379 - Portal Activity Report - Latest Version (SDA file).
You can compare the SP via the MANIFAST file, as it contains the version and SP number.
In order to troubleshoot problems in Activity Report, you can follow SAP note: 1690023 - Portal Activity Report - Component-specific Note
Some basic checks that you can do:
Run query on the raw data tables to check since when there is data in those tables:
select min(timestamphour) from SAP<SystemID>DB.WCR_WEBCNODESTAT;
If there is too much data from long time ago, then you should delete the old data, and leave only the new data (there is anyways retention time for the data to be kept).
If there is no data, then it means that the Portal Activity Report does not collect data, and not really activated (usually this is not the case).
The aggregation runs every top of the hour, so you can check in the default traces for an error during that time.
In most of the cases something went wrong while aggregating the data.
As a result the aggregation is not finished, so the transaction is not being committed, and the aggregated tables stay empty.
If there is a DuplicateKeyException in the trace, you can follow SAP note 1054145 - Duplicate Key Exception.
If you have any more questions, please don't hesitate to ask.
I hope this information helps,
Thanks & regards,
Michal Zilcha-Lang

How to list the documents in the Portal Activity Report?

Hello,
In the Portal Activity Report I would like to see the documents list with number of uploads, number of downloads and the username who have accessed the documents for monthly. Can any one help me where to mention all the details regarding this one. I didn't found anything regarding this in the Portal Activity Report.
Thnx in advance.
cheers,
Murali

Hello,
Can anyone help me solving this problem.
Thnx in advance
cheers
Murali

Create an Activity Report for Current Week

I would like to create a activity report for the current week. The trick is that if the weekday is Wednesday or earlier (Sunday being the first day of the week), the report shows last week's activities; but if the weekday is Thursday or later (Saturday being the last day of the week), the report shows the current weeks activities.
I have a filter that works in Access but does not seem to work in Siebel. It does just what I explained above:
Between CDate(Int((IIf(Weekday(Now())<=4,Now()-(6+Weekday(Now())),Now()-(Weekday(Now())-1))))) And CDate(Int((IIf(Weekday(Now())<=4,Now()-Weekday(Now()),Now()+(7-Weekday(Now()))))))
Thank you,
David
Edited by: DavidE on Oct 7, 2008 4:17 PM

David,
try this:
case DAYOFWEEK(CAST(Activity."Planned Start Time" AS date))when 1 then timestampadd(sql_tsi_day,1,CAST(Activity."Planned Start Time" AS date)) when 3 then timestampadd(sql_tsi_day,-1,CAST(Activity."Planned Start Time" AS date)) when 4 then timestampadd(sql_tsi_day,-2,CAST(Activity."Planned Start Time" AS date)) when 5 then timestampadd(sql_tsi_day,-3,CAST(Activity."Planned Start Time" AS date)) when 6 then timestampadd(sql_tsi_day,-4,CAST(Activity."Planned Start Time" AS date)) when 7 then timestampadd(sql_tsi_day,-5,CAST(Activity."Planned Start Time" AS date)) else CAST(Activity."Planned Start Time" AS date) end
This gave me the sunday of the week. You should be able to modify this format for your purposes.
cheers
Alex

KM Activity Reporting -- Enhancing Customer Reports

Hello friends,
I have a quick query on KM activity reporting . I came across this article by name "Enhancing Customer Reports with Commands and Parameters" by Thilo Brandt dated 11th July 2006 .
Here is the link to the article
https://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/docs/library/uuid/7d28a67b-0c01-0010-8d9a-d7e6811377c0
I would like to know if deploying the code given in the article would directly produce the report given in the article . Is this a fully functional code ? I am asking this because i have not come across any User Interface code in the example . Please respond with your comments at the earliest .
Many thanks in advance
Subra

Hi Subra,
look in the file DocumentAccessReport.java
and take a look in the middle of the file :
// reporting properties
protected static final List m_resultPropertyNames;
protected static final IPropertyName m_propDisplayname;
protected static final IPropertyName m_propUniqueUserCount;
protected static final IPropertyName m_propTotalCount;
protected static final IPropertyName m_propLastAccessed;
protected static final IPropertyName m_propLastModified;
Regards, Kai

Need to join two queries A/R statemet and Activity report

I have two separate queries that need to be one. I have an A/R statement where I want to add notes next to each invoice. Currently these are two separate reports. How can I link the activity Report to the A/R Statement. Below are the two separate reports. I am not sure how to join the files. A/R Aging Report Declare @d datetime set @d /*Select 1 from jdt1 t where t.duedate*/=[%1] select * from ( SELECT T1.CardCode, T1.CardName, T0.RefDate, T0.Ref1 'Document Number', CASE WHEN T0.TransType=13 THEN 'Invoice' WHEN T0.TransType=14 THEN 'Credit Note' WHEN T0.TransType=30 THEN 'Journal' WHEN T0.TransType=24 THEN 'Receipt' END AS 'Document Type', T0.DueDate, (T0.Debit- T0.Credit) 'Balance' ,ISNULL((SELECT T0.Debit-T0.Credit WHERE DateDiff(day, T0.DueDate,@d)=0 and DateDiff(day, T0.DueDate,@d)30 and DateDiff(day, T0.DueDate,@d)60 and DateDiff(day, T0.DueDate,@d)90 and DateDiff(day, T0.DueDate,@d)=121),0) '121+ Days' FROM JDT1 T0 INNER JOIN OCRD T1 ON T0.ShortName = T1.CardCode WHERE T1.CardType = 'C' ) sub Activity Report SELECT T1.[ClgCode],T2.[U_NAME], T4.[Name] as Status, T0.[CardCode], T0.[CardName], T0.[DocNum], T0.[U_AIS_DVIInvName] as 'SF Invoice Name', (T0.U_AIS_DVISFSO) as 'SO#', T0.[DocDate],T0.Taxdate as 'Month Of Service',T0.[U_AIS_DVIOpptyNm],T0.[U_AIS_DVIAdvNm],T0.[U_AIS_DVIManNm],T0.[U_AIS_DVIAcctNm], T0.[DocTotal], T0.[DocStatus], T1.[Recontact], T1.[Details], T1.[Notes], T1.[CntctType], T3.[Name] FROM OINV T0 left join OCLG T1 on t0.docentry = t1.docentry and T0.[ObjType] = T1.[DocType] left outer JOIN OUSR T2 ON T1.UserSign = T2.USERID left outer join OCLT T3 ON T1.CntctType = T3.Code left outer join OCLS T4 ON T1.CntctSbjct = T4.Code where T1.[CntctType] =6 or T1.[CntctType] =7

This is what I have so far.. it finally produced results but I notice the amount on the Activity + Aging does not match what is on the Aging and that seems to be what the issue is... that was my check to know the report is working. Basically the report should show the aging + any activity associated with the open invoice. The amount on the report is lower than the aging.. I am attaching the aging query and the aging with activity Query. It looks like something is not joining correctly as the amounts do not match on the balance. Aging Report Declare @d datetime set @d /*Select 1 from jdt1 t where t.duedate*/=[%1] select * from ( SELECT T1.CardCode, T1.CardName, T0.RefDate, T0.Ref1 'Document Number', CASE WHEN T0.TransType=13 THEN 'Invoice' WHEN T0.TransType=14 THEN 'Credit Note' WHEN T0.TransType=30 THEN 'Journal' WHEN T0.TransType=24 THEN 'Receipt' END AS 'Document Type', T0.DueDate, (T0.Debit- T0.Credit) 'Balance' ,ISNULL((SELECT T0.Debit-T0.Credit WHERE DateDiff(day, T0.DueDate,@d)=0 and DateDiff(day, T0.DueDate,@d)30 and DateDiff(day, T0.DueDate,@d)60 and DateDiff(day, T0.DueDate,@d)90 and DateDiff(day, T0.DueDate,@d)=121),0) '121+ Days' FROM JDT1 T0 INNER JOIN OCRD T1 ON T0.ShortName = T1.CardCode WHERE T1.CardType = 'C' ) sub Activity + Aging Declare @d datetime set @d /*Select 1 from jdt1 t where t.duedate*/=[%1] select * from ( SELECT T1.CardCode, T1.CardName, T0.RefDate, T0.Ref1 'Document Number', CASE WHEN T0.TransType=13 THEN 'Invoice' WHEN T0.TransType=14 THEN 'Credit Note' WHEN T0.TransType=30 THEN 'Journal' WHEN T0.TransType=24 THEN 'Receipt' END AS 'Document Type', T0.DueDate, (T0.Debit- T0.Credit) 'Balance' ,ISNULL((SELECT T0.Debit-T0.Credit WHERE DateDiff(day, T0.DueDate,@d)=0 and DateDiff(day, T0.DueDate,@d)30 and DateDiff(day, T0.DueDate,@d)60 and DateDiff(day, T0.DueDate,@d)90 and DateDiff(day, T0.DueDate,@d)=121),0) '121+ Days', T6.[FirstName] as 'AP Contact First Name', T6.[LastName] as 'AP Contact Last Name' , T6.[E_MailL], T6.[Notes1] as ' AP Supervisor', T2.[ClgCode],T7.[U_NAME], T4.[Name] as Status, T5.[DocNum], T5.[U_AIS_DVIInvName] as 'SF Invoice Name', (T5.U_AIS_DVISFSO) as 'SO#', T5.[DocDate],T5.Taxdate as 'Month Of Service',T5.[U_AIS_DVIOpptyNm],T5.[U_AIS_DVIAdvNm],T5.[U_AIS_DVIManNm],T5.[U_AIS_DVIAcctNm], T5.[DocTotal], T5.[DocStatus], T2.[Recontact], T2.[Details], T2.[Notes], T2.[CntctType], T3.[Name] FROM JDT1 T0 INNER JOIN OCRD T1 ON T0.ShortName = T1.CardCode INNER JOIN OCLG T2 ON T1.CardCode = T2.CardCode INNER JOIN OCLT T3 ON T2.CntctType = T3.Code INNER JOIN OCLS T4 ON T2.CntctSbjct = T4.Code INNER JOIN OINV T5 ON t5.docentry = t2.docentry and T5.[ObjType] = T2.[DocType] left outer join OCPR T6 ON T2.CntctCode = T6.CntctCode left outer JOIN OUSR T7 ON T2.UserSign = T7.USERID WHERE T1.CardType = 'C' and (T2.[CntctType] =6 or T2.[CntctType] =7) ) sub

ISE Guest Activity Report

Similar Messages

Maybe you are looking for